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■  Distributed  Risk  Management  Environment 

■  Security  vs.  Resilience 

■  Risk  Avoidance  vs.  Risk  Tolerance 

■  Way  Ahead 
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Distributed  Risk  Management 
Environment 


The  homeland  security  “enterprise”  refers  to  the  collective 
efforts  and  shared  responsibilities  of  Federal,  State,  local, 
tribal,  territorial,  nongovernmental,  and  private-sector 
partners  —  as  well  as  individuals,  families,  and 
communities  —  to  maintain  critical  homeland  security 
capabilities.  It  connotes  a  broad-based  community  with  a 
common  interest  in  the  safety  and  well-being  of  America 
and  American  society. 

Quadrennial  Homeland  Security  Review  Report,  February  2010 
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Distributed  Risk  Management 
Environment  (Cont.) 

■  There  is  an  expectation  of  local,  high-fidelity  coverage 
throughout  the  Nation 

■  Much  of  the  infrastructure  and  data  are  privately  owned 

■  The  NIPP  taxonomy  for  administration  does  not  correlate 
well  with  physical  “systems  of  systems” 

■  The  lack  of  consistency  among  systems  increases  the 
challenge  in  performing  cross-sector  analysis 

■  The  network  topology  of  the  systems  does  not  correlate 
with  political  boundaries 
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Security  vs.  Resilience 


■  National  Preparedness  Goal  Balances  Security  vs. 
Resilience 

-  Resilience  is  a  buzz  word  on  the  Hill 


■  Security 

-  Something  that  secures:  protection 

-  Measures  taken  to  guard  against  espionage  or  sabotage,  crime, 
attack,  or  escape 

-  Merriam-Webster 
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Security  vs.  Resilience  (Cont.) 


■  Resilience 

-  Ability  of  systems,  infrastructures,  government,  business,  and 
citizenry  to  resist,  absorb,  recover  from,  or  adapt  to  an  adverse 
occurrence  that  may  cause  harm,  destruction,  or  loss  of  national 
significance 

-  Capacity  of  an  organization  to  recognize  threats  and  hazards  and 
make  adjustments  that  will  improve  future  protection  efforts  and 
risk  reduction  measures 


-  DHS  Risk  Lexicon 


Security  vs.  Resilience  (Cont.) 


Infrastructure  Risk  Management  Continues  to  Mature 

■  Started  with  asset  protection  from  terrorists:  gates,  guards,  guns 

-  Police/Security  function 

■  Next  evolution  was  understanding  dependency  on  inputs  to  the 
asset 

-  Police/Security  Plus  function 

■  Current  evolution  was  understanding  a  nodes  role  within  a 
system/network 

-  Operations  Analyst/Systems  Engineer/Logistician  function 

■  Programs  stuck  in  Police/Security  mode  will  not  evolve 


Risk  Tolerance 


■  Risk  Avoidance:  strategies  or  measures  taken  that 
effectively  remove  exposure  to  a  risk 


■  Risk  Control:  deliberate  action  taken  to  reduce  the 
potential  for  harm  or  maintain  it  at  an  acceptable  level 


■  Risk  Tolerance:  degree  to  which  an  entity,  asset, 
system,  network,  or  geographic  area  is  willing  to  accept 
risk 
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Way  Ahead 


■  Continue  to  collaborate  and  coordinate 

■  Look  within  organizations  for  systems  analysis  expertise 

■  Continue  to  work  with  private  sector  partners 
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